What’s Vulnerable › Vulnerabilities

CVE-2016-8580

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-10-28 · updated 2026-06-17
• Weakness: CWE-284

Description

PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes.

Affected products

• Alienvault Open Source Security Information And Event Management: through 5.3.1
• Alienvault Unified Security Management: through 5.3.1

References

• http://www.securityfocus.com/bid/93864
• https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities
• https://www.exploit-db.com/exploits/40682/
• http://www.securityfocus.com/bid/93864
• https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities
• https://www.exploit-db.com/exploits/40682/

Get alerted when CVE-2016-8580 or the next vulnerability affects your stack